Automate Dependabot minor/patch PR approvals & merges

.github/dependabot.yml

@@ -8,10 +8,64 @@ updates:
   - package-ecosystem: "maven" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
-      interval: "weekly"
+      interval: "daily"
     reviewers:
       - "berrycloud/reviewers"
+    groups:
+      auto-merge-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        patterns:
+          - "com.h2database:h2"
+          - "com.jayway.jsonpath:json-path-assert"
+          - "com.puppycrawl.tools:checkstyle"
+          - "com.squareup.okhttp3:mockwebserver"
+          - "com.squareup.okhttp3:okhttp"
+          - "com.squareup.okhttp3:okhttp-bom"
+          - "io.hypersistence:hypersistence-utils-hibernate-70"
+          - "io.jsonwebtoken:jjwt-api"
+          - "io.jsonwebtoken:jjwt-impl"
+          - "io.jsonwebtoken:jjwt-jackson"
+          - "io.netty:netty-resolver-dns-native-macos"
+          - "jakarta.validation:jakarta.validation-api"
+          - "org.apache.maven.plugins:maven-checkstyle-plugin"
+          - "org.apache.maven.plugins:maven-compiler-plugin"
+          - "org.apache.maven.plugins:maven-failsafe-plugin"
+          - "org.apache.maven.plugins:maven-gpg-plugin"
+          - "org.apache.maven.plugins:maven-javadoc-plugin"
+          - "org.apache.maven.plugins:maven-release-plugin"
+          - "org.apache.maven.plugins:maven-source-plugin"
+          - "org.apache.maven.plugins:maven-surefire-plugin"
+          - "org.eclipse.m2e:lifecycle-mapping"
+          - "org.hibernate.validator:hibernate-validator"
+          - "org.jacoco:jacoco-maven-plugin"
+          - "org.projectlombok:lombok"
+          - "org.sonatype.central:central-publishing-maven-plugin"
+          - "org.springframework.boot:spring-boot-autoconfigure"
+          - "org.springframework.boot:spring-boot-devtools"
+          - "org.springframework.boot:spring-boot-jackson2"
+          - "org.springframework.boot:spring-boot-starter-data-jpa"
+          - "org.springframework.boot:spring-boot-starter-test"
+          - "org.springframework.boot:spring-boot-starter-validation"
+          - "org.springframework.boot:spring-boot-starter-web"
+          - "org.springframework.boot:spring-boot-starter-webflux"
+          - "org.springframework.boot:spring-boot-webmvc-test"
+          - "org.springframework.integration:spring-integration-test"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      auto-merge-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        patterns:
+          - "actions/checkout"
+          - "actions/create-github-app-token"
+          - "actions/setup-java"
+          - "actions/stale"
+          - "advanced-security/maven-dependency-submission-action"
+          - "dependabot/fetch-metadata"
+          - "github/codeql-action"

.github/workflows/dependabot-auto-approve.yml

@@ -0,0 +1,24 @@
+name: Dependabot Auto-Approve
+
+on: pull_request
+
+permissions:
+  pull-requests: write
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Get Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Approve minor and patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: |
+          gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,25 @@
+name: Dependabot Auto-Merge
+
+on: pull_request_review
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.event.action == 'submitted' && github.event.review.state == 'approved' && github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Get Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Enable auto-merge for minor and patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: |
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}